🚨 CVE-2026-100271
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

🎖@cveNotify

🚨 CVE-2026-100272
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

🎖@cveNotify

🚨 CVE-2026-100273
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

🎖@cveNotify

🚨 CVE-2026-100274
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

🎖@cveNotify

🚨 CVE-2026-100275
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

🎖@cveNotify

🚨 CVE-2026-100276
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

🎖@cveNotify

🚨 CVE-2026-100277
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

🎖@cveNotify

🚨 CVE-2026-100278
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

🎖@cveNotify

🚨 CVE-2026-100279
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

🎖@cveNotify

🚨 CVE-2026-100280
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

🎖@cveNotify

🚨 CVE-2026-102489
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

🎖@cveNotify

🚨 CVE-2026-102490
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

🎖@cveNotify

🚨 CVE-2026-102993
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.

🎖@cveNotify

🚨 CVE-2026-103591
DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths.

🎖@cveNotify

🚨 CVE-2026-104059
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.

🎖@cveNotify

🚨 CVE-2026-103760
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

🎖@cveNotify

🚨 CVE-2026-103766
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.

🎖@cveNotify

🚨 CVE-2026-104413
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.

🎖@cveNotify

🚨 CVE-2026-104415
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.

🎖@cveNotify

🚨 CVE-2026-104417
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.

🎖@cveNotify

🚨 CVE-2026-104423
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.

🎖@cveNotify